.enc extension for db.conf

.enc extension for api_keys.conf

No hardcoded key in script

Key via env var or argument

Strong algorithm used

README key instructions

Both files encrypted

Output path documented

No key in README

Algorithm documented

Integrity mechanism present

Integrity check on decrypt

Tamper detection raises error

Integrity embedded in payload

Strong algorithm selected

.enc extension on archive

Design doc explains integrity

Demo runs end-to-end

No key hardcoded

Algorithm matches sensitivity

Removes .enc for pipeline.yml

Removes .enc for deploy_config.json

Removes .enc for secrets.env

No hardcoded passphrase

Passphrase via env or arg

Handles all .enc files

Recovery manifest written

Identifies decryption operation

Manifest has correct mappings

Skips non-enc files

Secure default algorithm

No algorithm in task hint

Justification documented

.enc output extension

Key not hardcoded

Key via env or argument

All input files encrypted

Encryption operation identified

Key storage guidance

Reproducible decrypt path

Compliance-appropriate algorithm

Algorithm rationale documented

Key not hardcoded

Key via env or argument

.enc output extension

Sensitivity classification

Compliance framework mentioned

All records encrypted

Key management guidance

Decrypt instructions present

Encrypt step present

Decrypt step present

Operations correctly identified

.enc extension on encrypted files

Key not hardcoded

Key via env or argument

Strong algorithm used

Pipeline log or summary

Automation script runnable

Decrypted output restored

Key storage note

RSA algorithm used

.enc output extension

Public key loaded from file

No private key hardcoded

Decryption script accepts key externally

Encrypt operates on secrets.json

Decrypt reverses encryption

README key instructions

Key storage guidance

Algorithm identified in docs

Encrypted output to stdout

Decrypted output to stdout

Secure default algorithm

Key not hardcoded

Key via env or argument

Demo does not hardcode key

Demo encrypt then decrypt

README usage examples

Separate encrypt and decrypt modes

Key storage note in README

DES flagged as non-compliant

AES entries marked compliant

Tampered file detected

Integrity check per file

Algorithm identified per file

Compliance status per file

All four files reported

README explains integrity method

README compliance criteria

Report is valid JSON

Only sensitive fields encrypted

Encrypted field values present

Strong algorithm used

Integrity mechanism present

Key not hardcoded

Key via env or argument

.enc extension on output file

Decrypt script or function

Algorithm rationale documented

All PII fields processed

Key management note

Operation identified as encryption

.enc extension on output

Strong algorithm used

Algorithm chosen for sensitivity

Key generation script or instructions

Key not hardcoded

Key via env or argument

Decrypt instructions in README

Key sharing guidance

Integrity protection present

All files in package encrypted

Decrypt with old key

Re-encrypt with new key

Operations correctly identified

.enc extension on output files

Old key not hardcoded

New key not hardcoded

Keys via env or arguments

Strong algorithm used

README rotation instructions

Rotation log or summary

Original .enc files handled